CWE-686, Function Call With Incorrect Argument Type, is a caller that passes an argument of the wrong data type to a function. MITRE says it is most likely in loosely typed languages, in strongly typed languages where the types of variable arguments cannot be checked at compile time, and where implicit casting happens.
How it happens
A value arrives as a string where a number is expected, or an object where a list is expected. Nothing stops the call, and the function processes what it was given.
// Vulnerable: limit arrives from the query string as a string
function fetchRows(limit) {
return db.query("SELECT * FROM items LIMIT " + limit);
}
fetchRows(req.query.limit);
The function assumed a number. It got whatever the client sent. Even when no injection is involved, a wrong type can change comparison results or take an unexpected code path.
What an attacker gains
MITRE lists quality degradation as the consequence, and the record has no observed CVEs. The security effect depends on what the function does with the unexpected value, so treat this as an enabler of other weaknesses rather than a standalone exploit.
How to find it
MITRE says it usually shows up in testing or normal operation because the call produces incorrect behavior, though it describes this as opportunistic. Test with unexpected types on purpose: strings where numbers belong, nulls, arrays.
How to fix it
Make the type explicit at the boundary where data enters.
// Fixed: parse and validate at the edge
const limit = Number.parseInt(req.query.limit, 10);
if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
return res.status(400).end();
}
fetchRows(limit);
Use a type checker or schema validation where your language offers one, avoid implicit conversions in comparisons, and use parameterized queries instead of string building.
Quick check
Where should type checking happen?
At the boundary where outside data enters the program, so the rest of the code can rely on the type.
